Subcontrol 13.8

[adammontville]

Configure systems not to write data to external removable media, if there is no business need for supporting such devices.

Measures

> LTL: check if all data stored in USB devices are encrypted

Metrics

See measure

[adammontville]

Inputs:

• EI: Endpoint inventory

Operations:

• Enumerate all endpoints supporting external removable media
• Enumerate all endpoints with a business need to support external removable media
• Enumerate all endpoints without a business need to support external removable media
• For each endpoint without a business need to support external removable media, examine its external media configuration, noting whether it is appropriately or inappropriately configured
• Enumerate the inappropriately configured endpoints
• Enumerate the appropriately configured endpoints

Assumptions:

• The endpoint inventory reflects the business need for a given endpoint to support external removable media.

Measures:

• M1 = List of all endpoints supporting external removable media
• M2 = List of all endpoints with a business need to support external removable media
• M3 = List of all endpoints without a business need to support external removable media
• M4 = List of appropriately configured endpoints without a need to support external removable media
• M5 = List of inappropriately configured endpoints without a need to support external removable media
• M6 = |M1|
• M7 = |M2|
• M8 = |M3|
• M9 = |M4|
• M10 = |M5|

Metrics:

• M9 / M8 = Ratio of appropriately configured endpoints to the total number of endpoints without a business need to support external removable media